Initial plan

2026-08-24 17:43:08 +01:00 · 2026-08-18 00:51:26 +00:00
23 changed files with 118 additions and 301 deletions
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,25 +1,22 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
 version: 2
 updates:
+  # Enable version updates for npm
  - package-ecosystem: 'npm'
+    # Look for `package.json` and `lock` files in the `root` directory
    directory: '/'
+    # Check the npm registry for updates every day (weekdays)
    schedule:
-      interval: 'monthly'
-    cooldown:
-      default-days: 7
-    groups:
-      monthly-npm-updates:
-        applies-to: 'version-updates'
-        patterns:
-          - '*'
+      interval: 'weekly'

+  # Enable version updates for GitHub Actions
  - package-ecosystem: 'github-actions'
+    # Workflow files stored in the default location of `.github/workflows`
+    # You don't need to specify `/.github/workflows` for `directory`. You can use `directory: "/"`.
    directory: '/'
    schedule:
-      interval: 'monthly'
-    cooldown:
-      default-days: 7
-    groups:
-      monthly-actions-updates:
-        applies-to: 'version-updates'
-        patterns:
-          - '*'
+      interval: 'weekly'
--- a/.github/workflows/benchmark-cache-restore.yml
+++ b/.github/workflows/benchmark-cache-restore.yml
@@ -24,7 +24,6 @@ jobs:
  warm-caches:
    name: Warm ${{ matrix.tool }} ${{ matrix.profile }} caches (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
-    cache-mode: write-only
    strategy:
      fail-fast: false
      matrix:
@@ -66,7 +65,6 @@ jobs:
    name: Benchmark ${{ matrix.tool }} ${{ matrix.profile }} (${{ matrix.os }})
    needs: warm-caches
    runs-on: ${{ matrix.os }}
-    cache-mode: read
    strategy:
      fail-fast: false
      matrix:
--- a/.github/workflows/e2e-cache.yml
+++ b/.github/workflows/e2e-cache.yml
@@ -21,7 +21,6 @@ defaults:
 jobs:
  gradle-save:
    runs-on: ${{ matrix.os }}
-    cache-mode: write-only
    strategy:
      fail-fast: false
      matrix:
@@ -49,7 +48,6 @@ jobs:
          bash __tests__/check-dir.sh "$HOME/.gradle/wrapper/dists"
  gradle-restore:
    runs-on: ${{ matrix.os }}
-    cache-mode: read
    strategy:
      fail-fast: false
      matrix:
@@ -74,7 +72,6 @@ jobs:
        run: bash __tests__/check-dir.sh "$HOME/.gradle/wrapper/dists"
  maven-save:
    runs-on: ${{ matrix.os }}
-    cache-mode: write-only
    strategy:
      fail-fast: false
      matrix:
@@ -100,7 +97,6 @@ jobs:
          bash __tests__/check-dir.sh "$HOME/.m2/wrapper/dists"
  maven-restore:
    runs-on: ${{ matrix.os }}
-    cache-mode: read
    strategy:
      fail-fast: false
      matrix:
@@ -125,7 +121,6 @@ jobs:
        run: bash __tests__/check-dir.sh "$HOME/.m2/wrapper/dists"
  sbt-save:
    runs-on: ${{ matrix.os }}
-    cache-mode: write-only
    defaults:
      run:
        shell: bash
@@ -165,7 +160,6 @@ jobs:
        run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/.cache/coursier"
  sbt-restore:
    runs-on: ${{ matrix.os }}
-    cache-mode: read
    defaults:
      run:
        shell: bash
@@ -200,7 +194,6 @@ jobs:
        run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/.cache/coursier"
  gradle1-save:
    runs-on: ${{ matrix.os }}
-    cache-mode: write-only
    strategy:
      fail-fast: false
      matrix:
@@ -229,7 +222,6 @@ jobs:
          bash __tests__/check-dir.sh "$HOME/.gradle/wrapper/dists"
  gradle1-restore:
    runs-on: ${{ matrix.os }}
-    cache-mode: read
    strategy:
      fail-fast: false
      matrix:
@@ -254,7 +246,6 @@ jobs:
        run: bash __tests__/check-dir.sh "$HOME/.gradle/wrapper/dists"
  gradle2-restore:
    runs-on: ${{ matrix.os }}
-    cache-mode: read
    strategy:
      fail-fast: false
      matrix:
@@ -277,7 +268,6 @@ jobs:
        run: bash __tests__/check-dir.sh "$HOME/.gradle/caches" absent
  maven1-save:
    runs-on: ${{ matrix.os }}
-    cache-mode: write-only
    strategy:
      fail-fast: false
      matrix:
@@ -304,7 +294,6 @@ jobs:
          bash __tests__/check-dir.sh "$HOME/.m2/wrapper/dists"
  maven1-restore:
    runs-on: ${{ matrix.os }}
-    cache-mode: read
    strategy:
      fail-fast: false
      matrix:
@@ -329,7 +318,6 @@ jobs:
        run: bash __tests__/check-dir.sh "$HOME/.m2/wrapper/dists"
  maven2-restore:
    runs-on: ${{ matrix.os }}
-    cache-mode: read
    strategy:
      fail-fast: false
      matrix:
@@ -354,7 +342,6 @@ jobs:
        run: bash __tests__/check-dir.sh "$HOME/.m2/repository" absent
  sbt1-save:
    runs-on: ${{ matrix.os }}
-    cache-mode: write-only
    defaults:
      run:
        shell: bash
@@ -395,7 +382,6 @@ jobs:
        run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/.cache/coursier"
  sbt1-restore:
    runs-on: ${{ matrix.os }}
-    cache-mode: read
    defaults:
      run:
        shell: bash
@@ -430,7 +416,6 @@ jobs:
        run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/.cache/coursier"
  sbt2-restore:
    runs-on: ${{ matrix.os }}
-    cache-mode: read
    defaults:
      run:
        shell: bash
@@ -465,7 +450,6 @@ jobs:
        run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/.cache/coursier" absent
  custom-maven-path-save:
    runs-on: ubuntu-latest
-    cache-mode: write-only
    steps:
      - name: Checkout
        uses: actions/checkout@v7
@@ -490,7 +474,6 @@ jobs:
          bash __tests__/check-dir.sh "$RUNNER_TEMP/setup-java-custom-maven-repository"
  custom-maven-path-restore:
    runs-on: ubuntu-latest
-    cache-mode: read
    needs: custom-maven-path-save
    steps:
      - name: Checkout
--- a/.github/workflows/e2e-versions.yml
+++ b/.github/workflows/e2e-versions.yml
@@ -71,7 +71,7 @@ jobs:
            version: 25
          - distribution: oracle
            os: macos-15-intel
-            version: 21
+            version: 17
          - distribution: oracle
            os: windows-latest
            version: 21
--- a/.licenses/npm/fast-xml-parser.dep.yml
+++ b/.licenses/npm/fast-xml-parser.dep.yml
@@ -1,6 +1,6 @@
 ---
 name: fast-xml-parser
-version: 5.11.0
+version: 5.10.1
 type: npm
 summary: Validate XML, Parse XML, Build XML without C/C++ based libraries
 homepage:
--- a/.licenses/npm/strnum.dep.yml
+++ b/.licenses/npm/strnum.dep.yml
@@ -1,6 +1,6 @@
 ---
 name: strnum
-version: 2.4.2
+version: 2.4.1
 type: npm
 summary: Parse String to Number based on configuration
 homepage:
--- a/README.md
+++ b/README.md
@@ -9,13 +9,22 @@ Set up Java for GitHub Actions workflows. `setup-java` installs a requested Java
 ```yaml
 steps:
  - uses: actions/checkout@v7
-  - uses: actions/setup-java@v6
+  - uses: actions/setup-java@v5
    with:
      distribution: temurin
      java-version: '25'
  - run: java --version
 ```

+> [!NOTE]
+> V6 is still in development on the `main` branch and is not yet recommended for production workflows. To use it, you must explicitly reference the `main` branch in your workflow, as in 
+>
+> ```yaml
+> - uses: actions/setup-java@main
+> ```
+> 
+> For production workflows, it is recommended to use the latest stable release `v5`.
+
 ## Contents

 - [What it does](#what-it-does)
@@ -45,20 +54,15 @@ steps:

 ## What's new

-### V6
+### V6 (in development)

 - Migrated the action implementation to ESM to support the latest `@actions/*` packages.
- Added Oracle OpenJDK (`oracle-openjdk`), Red Hat Build of OpenJDK (`redhat`), and Liberica Native Image Kit (`liberica-nik`), and expanded Tencent Kona support through JDK 25.
+- Added the `oracle-openjdk` distribution for OpenJDK builds from Oracle.
 - Added `java-version: latest` to resolve the newest stable GA release from the distribution's remote metadata.
- Expanded install compatibility with JEP 322 multi-field versions such as `18.0.1.1`, Temurin `jdk+jmods` packages, and native musl artifacts on Alpine for Dragonwell, Corretto, Zulu, and Liberica.
- JDK downloads now automatically verify authoritative checksums, and package signature verification defaults to enabled for Temurin and Microsoft builds.
+- JDK downloads now automatically verify authoritative checksums for [supported distributions](#download-integrity-and-signatures).
 - Added `force-download: true` to bypass the tool cache and perform a reproducible fresh install.
 - Dependency caching now supports custom paths with `cache-path` and restore-only operation with `cache-read-only: true`.
- Dependency cache keys now include `.mvn/extensions.xml` and `gradle.properties`, preventing stale restores when Maven extensions or Gradle dependency properties change.
 - Downloaded JDKs are now [cached](#caching-jdk-installations) automatically when `cache` is set; use `cache-jdk` to enable or disable it independently.
- Warm JDK-cached jobs can reuse cached release metadata, avoiding vendor API calls while retaining a stale-metadata fallback for vendor outages and rate limits.
- Maven configuration now supports multiple server credentials and custom dependency-resolution repositories.
- Maven signing keys are imported into an isolated temporary GPG home instead of the runner's default keyring.
 - Set `problem-matcher: false` to disable Java compiler and uncaught-exception annotations.
 - GraalVM distributions now set `GRAALVM_HOME` in addition to `JAVA_HOME`.
 - Invalid boolean values, unsupported distribution/package/platform combinations, and mismatched Maven toolchain ID counts now fail with targeted errors.
@@ -69,7 +73,6 @@ steps:
 - Deprecated aliases still work, but emit warnings.
 - Maven GPG passphrases are now passed through `gpg.passphraseEnvName` instead of a deprecated `gpg.passphrase` server entry in `settings.xml`. This requires `maven-gpg-plugin` 3.2.0 or newer. See [GPG](docs/advanced-usage.md#gpg).
 - Legacy AdoptOpenJDK distributions were removed. Use `temurin` instead of `adopt` or `adopt-hotspot`, and `semeru` instead of `adopt-openj9`.
- See the [complete V6 release notes](https://github.com/actions/setup-java/releases/tag/v6.0.0) for all enhancements and fixes.

 ### V5

@@ -86,7 +89,7 @@ steps:
 ### Older versions

 > [!WARNING]
-> `actions/setup-java` versions `v1` through `v4` are deprecated. Upgrade workflows to `actions/setup-java@v6`, the latest stable release.
+> `actions/setup-java` versions `v1` through `v4` are deprecated. Upgrade workflows to `actions/setup-java@v5`, the latest stable release.

 ## Usage

@@ -95,7 +98,7 @@ steps:
 ```yaml
 steps:
  - uses: actions/checkout@v7
-  - uses: actions/setup-java@v6
+  - uses: actions/setup-java@v5
    with:
      distribution: temurin
      java-version: '25'
@@ -107,7 +110,7 @@ steps:
 ```yaml
 steps:
  - uses: actions/checkout@v7
-  - uses: actions/setup-java@v6
+  - uses: actions/setup-java@v5
    with:
      distribution: microsoft
      java-version: '25'
@@ -119,7 +122,7 @@ steps:
 ```yaml
 steps:
  - uses: actions/checkout@v7
-  - uses: actions/setup-java@v6
+  - uses: actions/setup-java@v5
    with:
      distribution: temurin
      java-version-file: .java-version
@@ -133,7 +136,7 @@ Supported version files are `.java-version`, `.tool-versions`, and `.sdkmanrc`.
 ```yaml
 steps:
  - uses: actions/checkout@v7
-  - uses: actions/setup-java@v6
+  - uses: actions/setup-java@v5
    with:
      distribution: temurin
      java-version: latest
@@ -156,7 +159,7 @@ steps:
 | `force-download` | Always download Java and replace any matching version in the tool cache. | `false` |
 | `set-default` | Add Java to `PATH` and set `JAVA_HOME`. When `false`, only version-specific `JAVA_HOME_<major>_<arch>` variables are set. | `true` |
 | `problem-matcher` | Register Java compiler and uncaught exception problem matchers. | `true` |
-| `verify-signature` | Verify downloaded Java package signatures when supported. Defaults to `true` for `temurin` and `microsoft`, and `false` for other distributions. | Automatically enabled for `temurin` and `microsoft` |
+| `verify-signature` | Verify downloaded Java package signatures when supported. Currently supported for `temurin` and `microsoft`. | `false` |
 | `verify-signature-public-key` | ASCII-armored GPG public key to use for signature verification. Overrides the bundled key. | |
 | `token` | Token for fetching GitHub.com-hosted version manifests, useful on GitHub Enterprise Server when unauthenticated requests are rate-limited. | `${{ github.token }}` on GitHub.com; empty string on GHES |
 | `cache` | Enable dependency caching for `maven`, `gradle`, or `sbt`. | |
@@ -264,7 +267,7 @@ Set `cache` to `maven`, `gradle`, or `sbt` to cache dependencies with minimal co
 ```yaml
 steps:
  - uses: actions/checkout@v7
-  - uses: actions/setup-java@v6
+  - uses: actions/setup-java@v5
    with:
      distribution: temurin
      java-version: '25'
@@ -283,7 +286,7 @@ The primary dependency cache key is `setup-java-<runner-os>-<node-arch>-<package
 Use `cache-dependency-path` to override the files used for key hashing, especially in monorepos:

 ```yaml
- uses: actions/setup-java@v6
+- uses: actions/setup-java@v5
  with:
    distribution: temurin
    java-version: '25'
@@ -296,7 +299,7 @@ Use `cache-dependency-path` to override the files used for key hashing, especial
 Use `cache-path` when the build tool stores dependencies outside the default location:

 ```yaml
- uses: actions/setup-java@v6
+- uses: actions/setup-java@v5
  with:
    distribution: temurin
    java-version: '25'
@@ -335,7 +338,7 @@ The JDK cache stores the downloaded JDK installation so later runs skip the down
 Set `cache-read-only: true` to restore dependency, wrapper, and JDK caches without saving changes in the post action. This is useful for pull requests, merge queues, short-lived branches, and matrix fan-out jobs that should only consume caches produced elsewhere.

 ```yaml
- uses: actions/setup-java@v6
+- uses: actions/setup-java@v5
  with:
    distribution: temurin
    java-version: '25'
@@ -351,7 +354,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
-      - uses: actions/setup-java@v6
+      - uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: '25'
@@ -366,7 +369,7 @@ jobs:
        goal: [test, verify, package]
    steps:
      - uses: actions/checkout@v7
-      - uses: actions/setup-java@v6
+      - uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: '25'
@@ -384,7 +387,7 @@ env:
  SEGMENT_DOWNLOAD_TIMEOUT_MINS: '5'
 steps:
  - uses: actions/checkout@v7
-  - uses: actions/setup-java@v6
+  - uses: actions/setup-java@v5
    with:
      distribution: temurin
      java-version: '25'
@@ -398,7 +401,7 @@ Install multiple Java versions by providing a multiline `java-version` value. Al

 ```yaml
 steps:
-  - uses: actions/setup-java@v6
+  - uses: actions/setup-java@v5
    with:
      distribution: temurin
      java-version: |
@@ -425,7 +428,7 @@ jobs:
    name: Java ${{ matrix.java }}
    steps:
      - uses: actions/checkout@v7
-      - uses: actions/setup-java@v6
+      - uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: ${{ matrix.java }}
@@ -442,7 +445,7 @@ jobs:
 ```yaml
 steps:
  - uses: actions/checkout@v7
-  - uses: actions/setup-java@v6
+  - uses: actions/setup-java@v5
    with:
      distribution: temurin
      java-version: '25'
@@ -464,7 +467,7 @@ required. See [Resolving Maven dependencies from custom repositories](docs/advan
 ```yaml
 steps:
  - uses: actions/checkout@v7
-  - uses: actions/setup-java@v6
+  - uses: actions/setup-java@v5
    with:
      distribution: temurin
      java-version: '25'
@@ -519,7 +522,7 @@ The scripts and documentation in this project are released under the [MIT Licens

 ## Contributions

-Contributions are welcome. See our [Contributor's Guide](docs/CONTRIBUTING.md).
+Contributions are welcome. See our [Contributor's Guide](docs/contributors.md).

 ## Code of Conduct

--- a/tests/distributors/jetbrains-installer.test.ts
+++ b/tests/distributors/jetbrains-installer.test.ts
@@ -78,8 +78,6 @@ function response(
 }

 describe('getAvailableVersions', () => {
-  jest.setTimeout(10_000);
-
  let spyHttpClient: any;
  let spyCoreError: any;
  const originalGitHubToken = process.env.GITHUB_TOKEN;
--- a/tests/distributors/microsoft-installer.test.ts
+++ b/tests/distributors/microsoft-installer.test.ts
@@ -398,12 +398,13 @@ describe('downloadTool', () => {
    jest.restoreAllMocks();
  });

-  it('verifies signatures by default', async () => {
+  it('verifies signature when enabled', async () => {
    const signedDistribution = new MicrosoftDistributions({
      version: '17',
      architecture: 'x64',
      packageType: 'jdk',
-      checkLatest: false
+      checkLatest: false,
+      verifySignature: true
    });

    await signedDistribution['downloadTool']({
--- a/tests/distributors/temurin-installer.test.ts
+++ b/tests/distributors/temurin-installer.test.ts
@@ -457,13 +457,14 @@ describe('downloadTool', () => {
    jest.restoreAllMocks();
  });

-  it('verifies signatures by default', async () => {
+  it('verifies signature when enabled', async () => {
    const distribution = new TemurinDistribution(
      {
        version: '17',
        architecture: 'x64',
        packageType: 'jdk',
-        checkLatest: false
+        checkLatest: false,
+        verifySignature: true
      },
      TemurinImplementation.Hotspot
    );
@@ -481,27 +482,6 @@ describe('downloadTool', () => {
    );
  });

-  it('does not verify signatures when explicitly disabled', async () => {
-    const distribution = new TemurinDistribution(
-      {
-        version: '17',
-        architecture: 'x64',
-        packageType: 'jdk',
-        checkLatest: false,
-        verifySignature: false
-      },
-      TemurinImplementation.Hotspot
-    );
-
-    await distribution['downloadTool']({
-      version: '17.0.14+7',
-      url: 'https://example.com/jdk.tar.gz',
-      signatureUrl: 'https://example.com/jdk.tar.gz.sig'
-    });
-
-    expect(spyVerifySignature).not.toHaveBeenCalled();
-  });
-
  it('downloads and adds matching JMODs to the JDK', async () => {
    spyDownloadTool
      .mockResolvedValueOnce('/tmp/jdk.tar.gz')
@@ -519,8 +499,7 @@ describe('downloadTool', () => {
        version: '25',
        architecture: 'x64',
        packageType: 'jdk+jmods',
-        checkLatest: false,
-        verifySignature: false
+        checkLatest: false
      },
      TemurinImplementation.Hotspot
    );
--- a/tests/setup-java.test.ts
+++ b/tests/setup-java.test.ts
@@ -161,37 +161,6 @@ describe('setup action orchestration', () => {
    expect(factory.getJavaDistribution).not.toHaveBeenCalled();
  });

-  it.each([
-    ['temurin', undefined, undefined],
-    ['zulu', undefined, undefined],
-    ['temurin', false, false],
-    ['zulu', true, true]
-  ])(
-    'passes signature verification input for %s with explicit value %s as %s',
-    async (distribution, explicitValue, expectedValue) => {
-      inputs.set('distribution', distribution);
-      multilineInputs.set('java-version', ['21']);
-      if (explicitValue !== undefined) {
-        inputs.set('verify-signature', String(explicitValue));
-        booleanInputs.set('verify-signature', explicitValue);
-      }
-      (factory.getJavaDistribution as jest.Mock).mockReturnValue({
-        setupJava: jest.fn(async () => ({
-          version: '21.0.4+7',
-          path: '/opt/java/21'
-        }))
-      });
-
-      await run();
-
-      expect(factory.getJavaDistribution).toHaveBeenCalledWith(
-        distribution,
-        expect.objectContaining({verifySignature: expectedValue}),
-        ''
-      );
-    }
-  );
-
  it('requires distribution when it cannot be inferred from the version file', async () => {
    inputs.set('java-version-file', '.java-version');
    (fs.readFileSync as jest.Mock).mockReturnValue(Buffer.from('21'));
@@ -231,6 +200,7 @@ describe('setup action orchestration', () => {
    booleanInputs.set('check-latest', true);
    booleanInputs.set('force-download', true);
    booleanInputs.set('set-default', false);
+    booleanInputs.set('verify-signature', true);
    inputs.set('verify-signature-public-key', 'public-key');
    (fs.readFileSync as jest.Mock).mockReturnValue(
      Buffer.from('java=21.0.5-tem')
@@ -262,7 +232,7 @@ describe('setup action orchestration', () => {
        forceDownload: true,
        cacheJdk: false,
        setDefault: false,
-        verifySignature: undefined,
+        verifySignature: true,
        verifySignaturePublicKey: 'public-key'
      },
      '/tmp/java.tar.gz'
--- a/action.yml
+++ b/action.yml
@@ -41,6 +41,7 @@ inputs:
  verify-signature:
    description: 'Verify downloaded Java package signatures when supported by the selected distribution'
    required: false
+    default: false
  verify-signature-public-key:
    description: 'ASCII-armored GPG public key used to verify the downloaded package signature. Overrides the default bundled key for the selected distribution.'
    required: false
--- a/dist/cleanup/767.index.js
+++ b/dist/cleanup/767.index.js
@@ -18680,26 +18680,12 @@ class XmlNode {
      this.child.push({ [node.tagname]: node.child });
    }
    // if requested, add the startIndex
-    this.addStartIndex(startIndex);
-  }
-
-  addStartIndex(startIndex) {
    if (startIndex !== undefined) {
      // Note: for now we just overwrite the metadata. If we had more complex metadata,
      // we might need to do an object append here:  metadata = { ...metadata, startIndex }
      this.child[this.child.length - 1][METADATA_SYMBOL] = { startIndex };
    }
  }
-
-  addEndIndex(endIndex) {
-    const lastChild = this.child[this.child.length - 1];
-    // endIndex is write-once: when updateTag drops a node, the last child is a
-    // previously completed sibling whose endIndex must not be overwritten
-    if (lastChild !== undefined && lastChild[METADATA_SYMBOL] !== undefined
-      && lastChild[METADATA_SYMBOL].endIndex === undefined) {
-      lastChild[METADATA_SYMBOL].endIndex = endIndex;
-    }
-  }
  /** symbol used for metadata */
  static getMetaDataSymbol() {
    return METADATA_SYMBOL;
@@ -18732,23 +18718,8 @@ class DocTypeReader {
            i = i + 9;
            let angleBracketsCount = 1;
            let hasBody = false, comment = false;
-            let quoteChar = null; // tracks an open SYSTEM/PUBLIC literal before the '[' body
            let exp = "";
            for (; i < xmlData.length; i++) {
-                // Inside a quoted external-identifier literal — XML allows '<'
-                // and '>' as plain data here, so they must not be interpreted
-                // as DOCTYPE structure until the matching quote closes.
-                if (quoteChar !== null) {
-                    if (xmlData[i] === quoteChar) quoteChar = null;
-                    exp += xmlData[i];
-                    continue;
-                }
-                if (!hasBody && !comment && (xmlData[i] === '"' || xmlData[i] === "'")) {
-                    quoteChar = xmlData[i];
-                    exp += xmlData[i];
-                    continue;
-                }
-
                if (xmlData[i] === '<' && !comment) { //Determine the tag type
                    if (hasBody && hasSeq(xmlData, "!ENTITY", i)) {
                        i += 7;
@@ -18803,7 +18774,7 @@ class DocTypeReader {
                    exp += xmlData[i];
                }
            }
-            if (quoteChar !== null || angleBracketsCount !== 0) {
+            if (angleBracketsCount !== 0) {
                throw new Error(`Unclosed DOCTYPE`);
            }
        } else {
@@ -19518,11 +19489,7 @@ function resolveEnotation(str, trimmedStr, options) {
 */
 function trimZeros(numStr) {
    if (numStr && numStr.indexOf(".") !== -1) {//float
-        //remove ending zeros without the O(n^2) backtracking that /0+$/ hits
-        //when the string doesn't end in 0 but has a long internal zero-run
-        let end = numStr.length;
-        while (end > 0 && numStr.charCodeAt(end - 1) === 48 /* '0' */) end--;
-        numStr = numStr.slice(0, end);
+        numStr = numStr.replace(/0+$/, ""); //remove ending zeros
        if (numStr === ".") numStr = "0";
        else if (numStr[0] === ".") numStr = "0" + numStr;
        else if (numStr[numStr.length - 1] === ".") numStr = numStr.substring(0, numStr.length - 1);
@@ -22998,12 +22965,7 @@ const parseXml = function (xmlData) {
        this.matcher.pop();
        this.isCurrentNodeStopNode = false; // Reset flag when closing tag

-        //a closing tag with no matching opening tag leaves the stack empty
-        currentNode = this.tagsNodeStack.pop() || xmlObj;//avoid recursion, set the parent tag scope
-
-        if (options.captureMetaData && currentNode) {
-          currentNode.addEndIndex(closeIndex + 1);
-        }
+        currentNode = this.tagsNodeStack.pop();//avoid recursion, set the parent tag scope
        textData = "";
        i = closeIndex;
      } else if (c1 === 63) { //'?'
@@ -23029,11 +22991,6 @@ const parseXml = function (xmlData) {
            childNode[":@"] = attsMap
          }
          this.addChild(currentNode, childNode, this.readonlyMatcher, i);
-
-          if (options.captureMetaData) {
-            // closeIndex points at '?' of the closing '?>'
-            currentNode.addEndIndex(tagData.closeIndex + 2);
-          }
        }


@@ -23198,10 +23155,6 @@ const parseXml = function (xmlData) {
          this.isCurrentNodeStopNode = false; // Reset flag

          this.addChild(currentNode, childNode, this.readonlyMatcher, startIndex);
-
-          if (options.captureMetaData) {
-            currentNode.addEndIndex(i + 1);
-          }
        } else {
          //selfClosing tag
          if (isSelfClosing) {
@@ -23212,10 +23165,6 @@ const parseXml = function (xmlData) {
              childNode[":@"] = prefixedAttrs;
            }
            this.addChild(currentNode, childNode, this.readonlyMatcher, startIndex);
-
-            if (options.captureMetaData) {
-              currentNode.addEndIndex(closeIndex + 1);
-            }
            this.matcher.pop(); // Pop self-closing tag
            this.isCurrentNodeStopNode = false; // Reset flag
          }
@@ -23225,10 +23174,6 @@ const parseXml = function (xmlData) {
              childNode[":@"] = prefixedAttrs;
            }
            this.addChild(currentNode, childNode, this.readonlyMatcher, startIndex);
-
-            if (options.captureMetaData) {
-              currentNode.addEndIndex(result.closeIndex + 1);
-            }
            this.matcher.pop(); // Pop unpaired tag
            this.isCurrentNodeStopNode = false; // Reset flag
            i = result.closeIndex;
--- a/dist/cleanup/index.js
+++ b/dist/cleanup/index.js
@@ -35575,9 +35575,6 @@ function _unique(values) {
 /******/ __nccwpck_require__.m = __webpack_modules__;
 /******/ 
 /************************************************************************/
-/******/ /* webpack/runtime/asset-relocator-loader */
-/******/ if (typeof __nccwpck_require__ !== 'undefined') __nccwpck_require__.ab = decodeURIComponent(new URL('.', import.meta.url).pathname).slice(import.meta.url.match(/^file:\/\/\/\w:/) ? 1 : 0, -1) + "/";
-/******/ 
 /******/ /* webpack/runtime/compat get default export */
 /******/ (() => {
 /******/ 	// getDefaultExport function for compatibility with non-harmony modules
@@ -35670,6 +35667,10 @@ function _unique(values) {
 /******/ 	};
 /******/ })();
 /******/ 
+/******/ /* webpack/runtime/compat */
+/******/ 
+/******/ if (typeof __nccwpck_require__ !== 'undefined') __nccwpck_require__.ab = new URL('.', import.meta.url).pathname.slice(import.meta.url.match(/^file:\/\/\/\w:/) ? 1 : 0, -1) + "/";
+/******/ 
 /******/ /* webpack/runtime/import chunk loading */
 /******/ (() => {
 /******/ 	// no baseURI
--- a/dist/setup/242.index.js
+++ b/dist/setup/242.index.js
@@ -244,8 +244,7 @@ class JavaBase {
            installerOptions.setDefault !== undefined
                ? installerOptions.setDefault
                : true;
-        this.verifySignature =
-            installerOptions.verifySignature ?? this.supportsSignatureVerification();
+        this.verifySignature = installerOptions.verifySignature ?? false;
        this.verifySignaturePublicKey = installerOptions.verifySignaturePublicKey;
    }
    async downloadAndVerify(javaRelease) {
--- a/dist/setup/824.index.js
+++ b/dist/setup/824.index.js
@@ -741,26 +741,12 @@ class XmlNode {
      this.child.push({ [node.tagname]: node.child });
    }
    // if requested, add the startIndex
-    this.addStartIndex(startIndex);
-  }
-
-  addStartIndex(startIndex) {
    if (startIndex !== undefined) {
      // Note: for now we just overwrite the metadata. If we had more complex metadata,
      // we might need to do an object append here:  metadata = { ...metadata, startIndex }
      this.child[this.child.length - 1][METADATA_SYMBOL] = { startIndex };
    }
  }
-
-  addEndIndex(endIndex) {
-    const lastChild = this.child[this.child.length - 1];
-    // endIndex is write-once: when updateTag drops a node, the last child is a
-    // previously completed sibling whose endIndex must not be overwritten
-    if (lastChild !== undefined && lastChild[METADATA_SYMBOL] !== undefined
-      && lastChild[METADATA_SYMBOL].endIndex === undefined) {
-      lastChild[METADATA_SYMBOL].endIndex = endIndex;
-    }
-  }
  /** symbol used for metadata */
  static getMetaDataSymbol() {
    return METADATA_SYMBOL;
@@ -795,23 +781,8 @@ class DocTypeReader {
            i = i + 9;
            let angleBracketsCount = 1;
            let hasBody = false, comment = false;
-            let quoteChar = null; // tracks an open SYSTEM/PUBLIC literal before the '[' body
            let exp = "";
            for (; i < xmlData.length; i++) {
-                // Inside a quoted external-identifier literal — XML allows '<'
-                // and '>' as plain data here, so they must not be interpreted
-                // as DOCTYPE structure until the matching quote closes.
-                if (quoteChar !== null) {
-                    if (xmlData[i] === quoteChar) quoteChar = null;
-                    exp += xmlData[i];
-                    continue;
-                }
-                if (!hasBody && !comment && (xmlData[i] === '"' || xmlData[i] === "'")) {
-                    quoteChar = xmlData[i];
-                    exp += xmlData[i];
-                    continue;
-                }
-
                if (xmlData[i] === '<' && !comment) { //Determine the tag type
                    if (hasBody && hasSeq(xmlData, "!ENTITY", i)) {
                        i += 7;
@@ -866,7 +837,7 @@ class DocTypeReader {
                    exp += xmlData[i];
                }
            }
-            if (quoteChar !== null || angleBracketsCount !== 0) {
+            if (angleBracketsCount !== 0) {
                throw new Error(`Unclosed DOCTYPE`);
            }
        } else {
@@ -1581,11 +1552,7 @@ function resolveEnotation(str, trimmedStr, options) {
 */
 function trimZeros(numStr) {
    if (numStr && numStr.indexOf(".") !== -1) {//float
-        //remove ending zeros without the O(n^2) backtracking that /0+$/ hits
-        //when the string doesn't end in 0 but has a long internal zero-run
-        let end = numStr.length;
-        while (end > 0 && numStr.charCodeAt(end - 1) === 48 /* '0' */) end--;
-        numStr = numStr.slice(0, end);
+        numStr = numStr.replace(/0+$/, ""); //remove ending zeros
        if (numStr === ".") numStr = "0";
        else if (numStr[0] === ".") numStr = "0" + numStr;
        else if (numStr[numStr.length - 1] === ".") numStr = numStr.substring(0, numStr.length - 1);
@@ -5065,12 +5032,7 @@ const parseXml = function (xmlData) {
        this.matcher.pop();
        this.isCurrentNodeStopNode = false; // Reset flag when closing tag

-        //a closing tag with no matching opening tag leaves the stack empty
-        currentNode = this.tagsNodeStack.pop() || xmlObj;//avoid recursion, set the parent tag scope
-
-        if (options.captureMetaData && currentNode) {
-          currentNode.addEndIndex(closeIndex + 1);
-        }
+        currentNode = this.tagsNodeStack.pop();//avoid recursion, set the parent tag scope
        textData = "";
        i = closeIndex;
      } else if (c1 === 63) { //'?'
@@ -5096,11 +5058,6 @@ const parseXml = function (xmlData) {
            childNode[":@"] = attsMap
          }
          this.addChild(currentNode, childNode, this.readonlyMatcher, i);
-
-          if (options.captureMetaData) {
-            // closeIndex points at '?' of the closing '?>'
-            currentNode.addEndIndex(tagData.closeIndex + 2);
-          }
        }


@@ -5265,10 +5222,6 @@ const parseXml = function (xmlData) {
          this.isCurrentNodeStopNode = false; // Reset flag

          this.addChild(currentNode, childNode, this.readonlyMatcher, startIndex);
-
-          if (options.captureMetaData) {
-            currentNode.addEndIndex(i + 1);
-          }
        } else {
          //selfClosing tag
          if (isSelfClosing) {
@@ -5279,10 +5232,6 @@ const parseXml = function (xmlData) {
              childNode[":@"] = prefixedAttrs;
            }
            this.addChild(currentNode, childNode, this.readonlyMatcher, startIndex);
-
-            if (options.captureMetaData) {
-              currentNode.addEndIndex(closeIndex + 1);
-            }
            this.matcher.pop(); // Pop self-closing tag
            this.isCurrentNodeStopNode = false; // Reset flag
          }
@@ -5292,10 +5241,6 @@ const parseXml = function (xmlData) {
              childNode[":@"] = prefixedAttrs;
            }
            this.addChild(currentNode, childNode, this.readonlyMatcher, startIndex);
-
-            if (options.captureMetaData) {
-              currentNode.addEndIndex(result.closeIndex + 1);
-            }
            this.matcher.pop(); // Pop unpaired tag
            this.isCurrentNodeStopNode = false; // Reset flag
            i = result.closeIndex;
--- a/dist/setup/index.js
+++ b/dist/setup/index.js
@@ -36065,9 +36065,6 @@ function _unique(values) {
 /******/ __nccwpck_require__.m = __webpack_modules__;
 /******/ 
 /************************************************************************/
-/******/ /* webpack/runtime/asset-relocator-loader */
-/******/ if (typeof __nccwpck_require__ !== 'undefined') __nccwpck_require__.ab = decodeURIComponent(new URL('.', import.meta.url).pathname).slice(import.meta.url.match(/^file:\/\/\/\w:/) ? 1 : 0, -1) + "/";
-/******/ 
 /******/ /* webpack/runtime/compat get default export */
 /******/ (() => {
 /******/ 	// getDefaultExport function for compatibility with non-harmony modules
@@ -36160,6 +36157,10 @@ function _unique(values) {
 /******/ 	};
 /******/ })();
 /******/ 
+/******/ /* webpack/runtime/compat */
+/******/ 
+/******/ if (typeof __nccwpck_require__ !== 'undefined') __nccwpck_require__.ab = new URL('.', import.meta.url).pathname.slice(import.meta.url.match(/^file:\/\/\/\w:/) ? 1 : 0, -1) + "/";
+/******/ 
 /******/ /* webpack/runtime/import chunk loading */
 /******/ (() => {
 /******/ 	// no baseURI
@@ -36375,6 +36376,7 @@ async function run() {
    const checkLatest = (0,util/* getBooleanInput */.Vt)(constants/* INPUT_CHECK_LATEST */.YM, false);
    const forceDownload = (0,util/* getBooleanInput */.Vt)(constants/* INPUT_FORCE_DOWNLOAD */.I9, false);
    const setDefault = (0,util/* getBooleanInput */.Vt)(constants/* INPUT_SET_DEFAULT */.E8, true);
+    const verifySignature = (0,util/* getBooleanInput */.Vt)(constants/* INPUT_VERIFY_SIGNATURE */.qy, false);
    const verifySignaturePublicKey = setup_java_core/* getInput */.V4(constants/* INPUT_VERIFY_SIGNATURE_PUBLIC_KEY */.u) || undefined;
    const toolchainIds = setup_java_core/* getMultilineInput */.q3(constants/* INPUT_MVN_TOOLCHAIN_ID */.nr);
    let actionError;
@@ -36402,7 +36404,6 @@ async function run() {
            else if (!distributionName) {
                throw new Error('distribution input is required when not specified in the version file');
            }
-            const verifySignature = getVerifySignatureInput();
            const installerInputsOptions = {
                architecture,
                packageType,
@@ -36427,7 +36428,6 @@ async function run() {
            if (!distributionName) {
                throw new Error('distribution input is required');
            }
-            const verifySignature = getVerifySignatureInput();
            const installerInputsOptions = {
                architecture,
                packageType,
@@ -36492,11 +36492,6 @@ function getJdkFileInput() {
    }
    return jdkFile || deprecatedJdkFile;
 }
-function getVerifySignatureInput() {
-    return setup_java_core/* getInput */.V4(constants/* INPUT_VERIFY_SIGNATURE */.qy).trim()
-        ? (0,util/* getBooleanInput */.Vt)(constants/* INPUT_VERIFY_SIGNATURE */.qy)
-        : undefined;
-}
 async function installVersion(version, options, toolchainId = 0) {
    const { distributionName, jdkFile, architecture, packageType, checkLatest, forceDownload, cacheJdk, setDefault, verifySignature, verifySignaturePublicKey, toolchainIds } = options;
    const installerOptions = {
--- a/docs/advanced-usage.md
+++ b/docs/advanced-usage.md
@@ -39,6 +39,15 @@

 See [action.yml](../action.yml) for more details on task inputs.

+> [!NOTE]
+> The examples on this page reference `actions/setup-java@v6`, which is still in
+> development on the `main` branch and is not yet published as a release tag. To
+> try the V6 features documented here (`cache-jdk`, `force-download`,
+> `problem-matcher`, `cache-path`, `cache-read-only`, `java-version: latest`,
+> `oracle-openjdk`, and the `*-env-var` input names), reference
+> `actions/setup-java@main`. For production workflows use the latest stable
+> release, `actions/setup-java@v5`, as shown in the [README](../README.md).
+
 ## Selecting a Java distribution
 `java-version` and `distribution` select what gets installed. `java-version` may be replaced by `java-version-file`, and `distribution` is optional only when `java-version-file` points to a `.sdkmanrc` or `.tool-versions` file that carries a recognized vendor identifier. In every other case both inputs must be provided. See [Supported distributions](../README.md#Supported-distributions) for a list of available options.

--- a/docs/contributors.md
+++ b/docs/contributors.md
@@ -1,4 +1,4 @@
-# Contributing
+# Contributors

 Thank you for contributing!

--- a/package-lock.json
+++ b/package-lock.json
@@ -16,21 +16,21 @@
        "@actions/http-client": "^4.0.1",
        "@actions/io": "^3.0.2",
        "@actions/tool-cache": "^4.0.0",
-        "fast-xml-parser": "^5.11.0",
+        "fast-xml-parser": "^5.10.1",
        "semver": "^7.8.5"
      },
      "devDependencies": {
        "@eslint/js": "^10.0.1",
        "@jest/globals": "^30.4.1",
-        "@types/node": "^26.2.0",
+        "@types/node": "^26.1.1",
        "@types/semver": "^7.8.0",
        "@typescript-eslint/eslint-plugin": "^8.67.0",
        "@typescript-eslint/parser": "^8.65.0",
-        "@vercel/ncc": "^0.45.0",
+        "@vercel/ncc": "^0.44.0",
        "eslint": "^10.7.0",
        "eslint-config-prettier": "^10.1.8",
-        "eslint-plugin-jest": "^29.16.1",
-        "eslint-plugin-n": "^18.3.0",
+        "eslint-plugin-jest": "^29.15.4",
+        "eslint-plugin-n": "^18.2.2",
        "globals": "^17.9.0",
        "husky": "^9.1.7",
        "jest": "^30.4.2",
@@ -1726,9 +1726,9 @@
      "license": "MIT"
    },
    "node_modules/@types/node": {
-      "version": "26.2.0",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.2.0.tgz",
-      "integrity": "sha512-5IviulTZeRNp2vAJ514cc/HUlY5nZ9fCbq9DMyC52BrhFZACo3nI0R7qBxhQmo/d27NFe96ur/b7Wwxklda+kg==",
+      "version": "26.1.2",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.1.2.tgz",
+      "integrity": "sha512-Vu4a5UFA9rIIFJ7rB/Vaafh9lrCQszopTCx6KjFboXTGQbPNasehVR5TEiithSDGyd1DEiUByggTZsg8jukeIg==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -2364,9 +2364,9 @@
      ]
    },
    "node_modules/@vercel/ncc": {
-      "version": "0.45.0",
-      "resolved": "https://registry.npmjs.org/@vercel/ncc/-/ncc-0.45.0.tgz",
-      "integrity": "sha512-8zPi1yO2mHpoKTD+e+Bf0ZT3e+sWHSOyGapm9s7b5R0gxJi3CiFTqmeQiMEyu6ejrz2s09M8JkEoUaTWjBJPQQ==",
+      "version": "0.44.1",
+      "resolved": "https://registry.npmjs.org/@vercel/ncc/-/ncc-0.44.1.tgz",
+      "integrity": "sha512-cUjIE5P2YY1n+Kt9rFIazMMpGoPn1Fic04rOmTkElMkiDP5oszGfERMpo2shVkFKDL7rVppdM2pqJKC59shQWQ==",
      "dev": true,
      "license": "MIT",
      "bin": {
@@ -3123,9 +3123,9 @@
      }
    },
    "node_modules/eslint-plugin-jest": {
-      "version": "29.16.1",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-jest/-/eslint-plugin-jest-29.16.1.tgz",
-      "integrity": "sha512-tfxOIsjzaBud+f74aLbBMRcnrztt5eCIgnAdeoGdnzMAQ4IdAa/s/p8Ls55mk9MC79N3j2jbv4Qetz6Hclbcfw==",
+      "version": "29.16.0",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-jest/-/eslint-plugin-jest-29.16.0.tgz",
+      "integrity": "sha512-0WFBxDHlT2ratGQfnFQEVIsgQJ5cfd+0IV8Kc6U3X2onB8ATLG23voD2Ch5G9fCkEpCPmCMuzW0tbS0kYb8biw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -3153,9 +3153,9 @@
      }
    },
    "node_modules/eslint-plugin-n": {
-      "version": "18.3.0",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-n/-/eslint-plugin-n-18.3.0.tgz",
-      "integrity": "sha512-cPVguuDe6DrIPb/qUXHf8P89MaVTUmiYWwpt5gX5AILsvRIiZAxMFXcFR6QHYBksqKJpjfUBlL/RleCJUWcD7w==",
+      "version": "18.2.2",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-n/-/eslint-plugin-n-18.2.2.tgz",
+      "integrity": "sha512-gOO0lIqwEjZ750kv9/SptCWArUoAZXJoBr0vYWTO2dCBxctHUXlBIigiC8xuxxr/NKqgIT6Ehz1xRcilj8a5cA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -3463,9 +3463,9 @@
      }
    },
    "node_modules/fast-xml-parser": {
-      "version": "5.11.0",
-      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.11.0.tgz",
-      "integrity": "sha512-9IGxMqvqLOnqP+Egi1nqDHKv5k8aZ7r9n558enxcucmyVGEBNPAU+MOg/8jPIS7rO7sSq4gFm1/nHtiaubMruw==",
+      "version": "5.10.1",
+      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.10.1.tgz",
+      "integrity": "sha512-IEMIf7298kXuZSRFoGfMYrl7is8LpavODgbNz1cwIudv7KwVFnuU+UsMporfq6PD6aXSlawZlARiA3UywCTfMw==",
      "funding": [
        {
          "type": "github",
@@ -3478,7 +3478,7 @@
        "fast-xml-builder": "^1.2.0",
        "is-unsafe": "^2.0.0",
        "path-expression-matcher": "^1.6.2",
-        "strnum": "^2.4.2",
+        "strnum": "^2.4.1",
        "xml-naming": "^0.3.0"
      },
      "bin": {
@@ -5530,9 +5530,9 @@
      }
    },
    "node_modules/strnum": {
-      "version": "2.4.2",
-      "resolved": "https://registry.npmjs.org/strnum/-/strnum-2.4.2.tgz",
-      "integrity": "sha512-rDG3Ah4TV0k1hWvLSzkZtMmLN9+eS+h3knq4MP6A42Y3Yh5qGNnOUs1jJkoSr8FG5dsL28c7KgkIBzSEykqtuw==",
+      "version": "2.4.1",
+      "resolved": "https://registry.npmjs.org/strnum/-/strnum-2.4.1.tgz",
+      "integrity": "sha512-M9eUSMT2dCB2cTNPG7UYj6KuK7RJR2SN2+yCV/fTW3xzTCS6EaGZ5pSMgDIjB7r8zSfTGk+dvvn9rTjpVS9Mwg==",
      "funding": [
        {
          "type": "github",
--- a/package.json
+++ b/package.json
@@ -49,21 +49,21 @@
    "@actions/http-client": "^4.0.1",
    "@actions/io": "^3.0.2",
    "@actions/tool-cache": "^4.0.0",
-    "fast-xml-parser": "^5.11.0",
+    "fast-xml-parser": "^5.10.1",
    "semver": "^7.8.5"
  },
  "devDependencies": {
    "@eslint/js": "^10.0.1",
    "@jest/globals": "^30.4.1",
-    "@types/node": "^26.2.0",
+    "@types/node": "^26.1.1",
    "@types/semver": "^7.8.0",
    "@typescript-eslint/eslint-plugin": "^8.67.0",
    "@typescript-eslint/parser": "^8.65.0",
-    "@vercel/ncc": "^0.45.0",
+    "@vercel/ncc": "^0.44.0",
    "eslint": "^10.7.0",
    "eslint-config-prettier": "^10.1.8",
-    "eslint-plugin-jest": "^29.16.1",
-    "eslint-plugin-n": "^18.3.0",
+    "eslint-plugin-jest": "^29.15.4",
+    "eslint-plugin-n": "^18.2.2",
    "globals": "^17.9.0",
    "husky": "^9.1.7",
    "jest": "^30.4.2",
--- a/src/distributions/base-installer.ts
+++ b/src/distributions/base-installer.ts
@@ -68,8 +68,7 @@ export abstract class JavaBase {
      installerOptions.setDefault !== undefined
        ? installerOptions.setDefault
        : true;
-    this.verifySignature =
-      installerOptions.verifySignature ?? this.supportsSignatureVerification();
+    this.verifySignature = installerOptions.verifySignature ?? false;
    this.verifySignaturePublicKey = installerOptions.verifySignaturePublicKey;
  }

--- a/src/setup-java.ts
+++ b/src/setup-java.ts
@@ -29,6 +29,10 @@ export async function run() {
  const checkLatest = getBooleanInput(constants.INPUT_CHECK_LATEST, false);
  const forceDownload = getBooleanInput(constants.INPUT_FORCE_DOWNLOAD, false);
  const setDefault = getBooleanInput(constants.INPUT_SET_DEFAULT, true);
+  const verifySignature = getBooleanInput(
+    constants.INPUT_VERIFY_SIGNATURE,
+    false
+  );
  const verifySignaturePublicKey =
    core.getInput(constants.INPUT_VERIFY_SIGNATURE_PUBLIC_KEY) || undefined;
  const toolchainIds = core.getMultilineInput(constants.INPUT_MVN_TOOLCHAIN_ID);
@@ -76,8 +80,6 @@ export async function run() {
        );
      }

-      const verifySignature = getVerifySignatureInput();
-
      const installerInputsOptions: installerInputsOptions = {
        architecture,
        packageType,
@@ -105,8 +107,6 @@ export async function run() {
        throw new Error('distribution input is required');
      }

-      const verifySignature = getVerifySignatureInput();
-
      const installerInputsOptions: installerInputsOptions = {
        architecture,
        packageType,
@@ -192,12 +192,6 @@ function getJdkFileInput(): string {
  return jdkFile || deprecatedJdkFile;
 }

-function getVerifySignatureInput(): boolean | undefined {
-  return core.getInput(constants.INPUT_VERIFY_SIGNATURE).trim()
-    ? getBooleanInput(constants.INPUT_VERIFY_SIGNATURE)
-    : undefined;
-}
-
 async function installVersion(
  version: string,
  options: installerInputsOptions,
@@ -269,7 +263,7 @@ interface installerInputsOptions {
  forceDownload: boolean;
  cacheJdk: boolean;
  setDefault: boolean;
-  verifySignature: boolean | undefined;
+  verifySignature: boolean;
  verifySignaturePublicKey: string | undefined;
  distributionName: string;
  jdkFile: string;